ISTAT(1)

💅 ISTAT — like, the inode tell-all, bestie

okay so this is istat, part of the General Commands Manual crew, and it's literally the vibe check for a single meta-data structure. Sit down, grab a strawberry 🍓, we're doing this.

✨ NAME ✨

istat — Display details of a meta-data structure (i.e. inode)

no cap, that's the whole job. one structure, all its lore, served fresh.

🦋 SYNOPSIS 🦋

istat [-B num ] [-f fstype ] [-i imgtype] [-o imgoffset] [-b
dev_sector_size] [-vV] [-z zone ] [-s seconds ] image [images] inode

🌸 DESCRIPTION 🌸

istat spills all the tea on one structure: its uid, gid, mode, size, link number, modified time, accessed time, changed time, and every single disk unit that structure has allocated. it's giving full dossier. main character energy for one tiny inode. 👑

The options are as follows:

✨ OPTIONS ✨

• -B num — Display the addresses of num disk units. super useful when the inode is unallocated with size 0 but still has block pointers — like, ghost blocks, iconic behavior honestly 💀
• -f fstype — Specify the file system type. hit '-f list' to list the supported file system types. if you don't give it, autodetection methods are used. let the tool guess, she's good at it 🧚
• -s seconds — The time skew of the original system in seconds. for example, if the original system was 100 seconds slow, this value would be -100. yes, negative. do the math, bestie 🕰️
• -i imgtype — Identify the type of image file, such as raw. use '-i list' to list the supported types. if not given, autodetection methods are used. same deal as -f, she figures it out ✨
• -o imgoffset — The sector offset where the file system starts in the image. tell her where the actual party starts 🎀
• -b dev_sector_size — The size, in bytes, of the underlying device sectors. if not given, the value in the image format is used (if it exists) or 512-bytes is assumed. default queen behavior 💅
• -v — Verbose output of debugging statements to stderr. she will yap, and she will yap to stderr specifically 🫶
• -V — Display version. quick lil "who am i" moment 🌈
• -z zone — An ASCII string of the original system's time zone. for example, EST5EDT or GMT. these strings are defined by the operating system and may vary. NOTE: This has changed since TCTUTILs. ⚠️ (not me warning you about a legacy change, but here we are)
• image [images] — The disk or partition image to read, whose format is given with '-i'. multiple image file names can be given if the image is split into multiple segments. if only one image file is given, and its name is the first in a sequence (e.g., as indicated by ending in '.001'), subsequent image segments will be included automatically. she'll find the rest of the friend group herself, no stress 🦋
• inode — Meta-data number to display stats on. the one (1) structure you're here for. pick her, she's the moment ⭐

👑 AUTHOR 👑

Brian Carrier <carrier at sleuthkit dot org>

Send documentation updates to <doc-updates at sleuthkit dot org>

like, respect the authors fr fr, they built the whole thing 💖

and that's the page, bestie — the header said ISTAT(1) with General Commands Manual energy, and the footer signed off with ISTAT(1) all by itself, so consider this the cute lil sign-off: ISTAT(1), periodt. go check an inode, you ate. 💅✨